The Maine Public Broadcasting Network
Listen Live
Classical 24
Visible By Administrators Only
Data Breach Disclosure Bill Debated in Augusta
02/28/2013   Reported By: A.J. Higgins

When TD Bank misplaced some data tape containing the personal information of nearly 35,000 Mainers a year ago, the company waited several months before informing its customers. State Rep. Sharon Treat said that's too long and she wants business and financial institutions to notify customers sooner. A number of banking and insurance lobbyists lined up to oppose Treat's bill, saying that in many cases, that could jeopardize an investigation.

Having her credit card hacked isn't the only reason Democratic state Rep. Sharon Treat wants a quicker reporting period when security breaches occur, but it's the one that made the biggest impression.

"I got notice that someone was out there using my credit card number to buy all kinds of things across the country while I was just sitting at home enjoying my breakfast," Treat said.

During a public hearing before the Legislature's Insurance and Financial Services Committee, Treat said the turnaround time for businesses and financial institutions to alert customers about possible security breaches was highlighted last year. In October, officials at TD Bank confirmed they had waited six months before telling the Maine Attorney General's Office about the loss of bank data associated with 35,000 of its customers. At the time, the bank's chief privacy officer acknowledged that two computer data backup tapes went missing while they were being shipped to a TD Bank location. Treat said current Maine law does not require institutions to make notifications as expediently as possible. She said the TD Bank case apparently suggests that six months is a reasonable period of time.

"It just seems to me that that was in contravention to the intent of Maine law and that if that was possible to be contravened in that matter then we ought to fix our law if we can," Treat said.

Treat's bill would remove the uncertain time frame in current law and set a 30-day window for reporting breaches. It would also double the current range of fines for violates to $1,000 to $5,000. Oami Amarasingham, of the American Civil Liberties Union of Maine, told the committee there have already been 78 privacy breaches at U.S. institutions this year. She said imperative consumers know about such situations as quickly as possible.

"This bill would afford greater protection to Mainers who are victims of privacy breaches," Amarasingham said. "The sooner a consumer whose personal information has been compromised becomes aware of a breach, the sooner she can take the necessary steps to protect her identity and privacy. Because this bill increases privacy protections for all Mainers, we urge you to vote ought to pass."

But opponents of the bill say it could create more problems than it solves. Kathy Keneborus represents the Maine Bankers Association. She said Treats 30-day window for reporting is not in compliance with federal regulations.

"This is not the case when the notification process is part of a rigorous financial regulatory structure," Kathy Keneborus said. "Federal regulators debated the timing of customer notices when they adopted the current federal guidance. Regulators concluded that the facts and the circumstances of each particular breach case make it impossible to designate a specific number of days by which a financial institution should provide notice to customers."

Charlie Soltan, of the Maine Association of Insurance Companies, told the panel that in many instances notification delays are triggered by requests from police agencies that are investigating potential fraud cases.

"Law enforcement will try to step in to also follow up and sometimes they tell you don't act yet, don't make any notice because we're trying to figure out who and how the culprit did this and if we can catch them," Soltan said. "That is why we all have concerns about the 30-day requirement."

The Insurance and Financial Services Committee has scheduled a work session on the bill for March 19th.


Become a Fan of the NEW MPBNNews Facebook page. Get news, updates and unique content to share and discuss:

Recommended by our audience on Facebook:
Copyright © 2015 Maine Public Broadcasting Network. All rights reserved.